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Abstract — In this paper we study the problem of half- 
duplex active eavesdropping in fast fading channels. The active 
eavesdropper is a more powerful adversary than the classical 
eavesdropper. It can choose between two functional modes: 
eavesdropping the transmission between the legitimate parties 
(Ex mode), and jamming it (Jx mode) - the active eavesdropper 
cannot function in full duplex mode. We consider a conservative 
scenario, when the active eavesdropper can choose its strategy 
based on the legitimate transmitter-receiver pair's strategy - 
and thus the transmitter and legitimate receiver have to plan 
for the worst. We show that conventional physical-layer secrecy 
approaches perform poorly (if at all), and we introduce a novel 
encoding scheme, based on very limited and unsecured feedback 
- the Block-Markov Wyner (BMW) encoding scheme - which 
outperforms any schemes currently available. 

Index Terms — Eavesdropper Channel, Secrecy Capacity, Bi- 
nary Symmetric Channels, Feedback. 

I. Introduction 

A great number of recent works have been fueled by the 
still growing interest in physical layer secrecy. Most of them 
attempt to overcome the limitations of the classical wiretap- 
per/eavesdropper scenarios of H] or J2) (namely that no secret 
message can be successfully transmitted if the eavesdropper's 
channel is less noisy than the legitimate receiver's channel) by 
using some form of diversity. 

The benefits of the ergodic-fading diversity upon the achiev- 
able secrecy rates have been exposed by works like Q, |4j, 
or J6). A fast-fading eavesdropper channel is studied in 
j3| under the assumption that the main channel is a fixed-SNR 
additive white Gaussian noise (AWGN) channel. Although the 
secrecy capacity for fast-fading eavesdropper channels is still 
unknown, Q provides achievable secrecy rates and shows that 
sometimes noise injection at the transmitter can improve these 
rates. 

The different approach of |4;| models both the main and the 
eavesdropper channels as ergodicly-fading AWGN channels. 
However, the fading is assumed to be slow enough to be 
considered constant for infinitely long blocks of transmitted 
symbols. The secrecy capacity is derived for this model, and 
the achievability part is proved by using separate channel 
encoding for each of the blocks. A similar approach is taken 
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in J5) and J6), where the fading broadcast channel with 
confidential messages (BCC) is considered equivalent to a 
parallel AWGN BCC. 

However, the slow fading ergodic channel model is quite 
restrictive. Although the model can be artificially created by 
a multiplexing/demultiplexing architecture as in Q, it still 
requires either coarse quantization or long delays (e.g. under 
fine quantization, for a channel state with low probability it 
may take a very large number of transmitted symbols to enable 
almost-error-free decoding). 

With these considerations, we focus instead on a more 
practical scenario where both the main and the eavesdropper's 
channel are affected by fast stationary fading. However, unlike 
O, we are concerned with a much stronger adversary: a half- 
duplex active eavesdropper. 

In our channel model, depicted in FigureQ] the eavesdropper 
(Eve) has two options: either to jam the conversation between 
the legitimate transmitter (Alice) and the legitimate receiver 
(Bob) - Jx mode - or to eavesdrop - Ex mode - (our 
eavesdropper cannot function in full duplex mode, i.e. she 
cannot transmit and receive on the same frequency slot, at the 
same time). Both Alice and Eve (in Jx mode) are constrained 
by average (over each codeword) power budgets 3* and ^ , 
respectively. Eve's purpose is to minimize the secrecy rate 
achievable by Alice, and to that extent she has to decide 
on the optimal alternation between the jamming mode and 
the eavesdropping mode. The state of each of the main 
and eavesdropper channels, i.e. the absolute squared channel 
coefficients (or simply "the channel coefficients" hence forth), 
which we denote by Km and hw, respectively, are assumed 
to be available to the respective receivers. However, Bob does 
not know the exact state of Eve's channel, nor does Eve have 
any information about Bob's channel, except its statistics. 
In addition to fading, each channel is further distorted by 
an independent additive white complex Gaussian noise of 
variance a 2 N . There exists a low-rate, unprotected (i.e. public) 
feedback channel between Bob and Alice. 

The present paper is limited to the following simplifying 
(although not uncommon) assumptions. 

i) Rayleigh fading: Hm and hw ar e exponentially dis- 
tributed, with parameters Am and \w respectively. 

ii) The channel that links Eve (when in Jx mode) and Bob 
is error free and does not experience fading JU, J9). 

iii) Eve only uses white Gaussian noise for jamming IflOl , 
||8l , since this is the most harmful uncorrelated jamming 
strategy ifTTl . 
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Fig. 1. Channel model 



iv) Eve's exact jamming strategy (i.e. when and with what 
power she jams) is perfectly known to Bob (a posteriori) Q 
so that Bob can employ coherent detection and communicate 
Eve's strategy to Alice, via the low-rate feedback link. 

v) The instantaneous state of the main channel cannot be 
known to the transmitter Alice non-causally. 

vi) The codewords are long enough such that not only the 
channel fading, but also the combination of channel fluctuation 
and Eve's alternation between jamming and eavesdropping 
display ergodic properties over the duration of a codeword. 

vii) Eve employs an ergodic strategy, i.e. she uses the same 
statistics for alternating between Jx mode and Ex mode for 
every codeword. 

viii) Eve has access to the exact value of hw only after 
she made her decision to eavesdrop (Ex mode), and has no 
information about the value(s) that hw might take while she 
is in Jx mode. This scenario models a situation where the 
training sequences, which are transmitted by Alice at a low 
rate, and are used by Bob to estimate the channel coefficient 
before the transmission of a block of symbols, are protected 
against eavesdropping (for instance, by using some form of 
secrecy encoding designed for non-coherent reception) or are 
simply unknown to Eve. Therefore, Eve cannot use the training 
sequences for estimating hw- However, if Eve's channel is 
fading slowly enough, Eve may be able to perform some 
form of blind channel estimation. Nevertheless, this kind of 
procedure would require Eve to first listen to the incoming 
signal for a longer time interval, possibly as long as her 
channel coherence time. Under these circumstances, Eve has 
to take the decision on whether to jam or eavesdrop in the 
absence of any non-causal channel state information (i.e. 
randomly). 

Our contributions can be stated as follows: 

> We introduce the concept of (half-duplex) active eaves- 
dropper; 

> We show that, under our conservative scenario, Wyner's 
scheme H] performs poorly (if at all); 

'To estimate exactly where Eve jams, one may argue that Bob needs the 
coherence time of the channel (which includes Eve's alternation between jam- 
ming and eavesdropping) to span several channel uses. But since the jammer's 
hardware construction will most probably prevent Eve from switching between 
Ex and Jx modes instantaneously, the coherence time of the jamming is not 
likely to pose any problems. On the other hand, the coherence time of the 
channel coefficient hy/ can be assumed large enough to allow for Bob's 
binary hypothesis testing (Ex or Jx) without bringing up any of the problems 
of 0, (U, (6), where the coherence time needs to be large enough to allow 
hypothesis testing (decoding) between a number of hypotheses (codewords) 
which increases exponentially with the codeword length. 



* We provide a novel block-Markov Wyner (BMW) secrecy 
encoding scheme, which requires a low-rate, unsecured 
feedback link from Bob to Alice, and can improve the 
secrecy rate significantly; 

« Our BMW scheme employs a diversity of concepts, 
such as a-posteriori Wyner-type binning, block-Markov 
secrecy encoding and encoding for a compound channel; 

• We provide a secrecy-encoding method for multiple- 
access channels (MACs), where even if some of the users 
are not decodable by the receiver, they can still help with 
the transmission of secrecy. 

We should note that our BMW scheme displays greater 
generality, and is not limited to the present scenario. In fact, we 
are currently investigating its use in extending the concepts of 
physical-layer secrecy to more realistic slowly-fading-channel 
models. 

II. The Conservative Scenario and the Achievable 
Secrecy Rates 

Physical-layer secrecy is synonymous to Wyner-type 
secrecy-encoding schemes QJ. The main idea behind these 
schemes is to create a special channel code, taylored to 
exploit the physical disadvantages of Eve's channel. Alice 
and Bob agree on a certain binning strategy, taylored to 
a certain pair of one main and one eavesdropper channels. 
Nevertheless, Eve's actual channel quality remains unknown. 
In fact, in most passive-eavesdropper scenarios, Eve herself 
remains undetected. Therefore, the Wyner-type schemes are 
not influenced by Eve's position, but by the legitimate parties' 
perception about her position. 

In our active-eavesdropper scenario, Eve can alternate be- 
tween jamming and eavesdropping. However, it is not this 
feature that turns out to be devastating for the transmission of 
secret messages, as much as the legitimate parties' uncertainty 
about Eve's strategy. To provide a stable framework for 
our investigation, we shall agree on the following notation 
and concepts. Throughout this paper, we shall denote q = 
P?'{Ex mode} the probability that Eve is in Ex mode over 
a given frame. Note that under our assumptions, q uniquely 
determines Eve's strategy over a frame, and remains unknown 
to Alice until the end of the frame. 

Obviously, Eve's presence causes a modification of the 
channel statistics (as Alice and Bob see them). For example, 
whenever Eve is eavesdropping (in Ex mode), the main 
channel instantaneous SNR is ^4^, while the SNR of Eve's 

a N 
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channel is 



no modification here. However, when Eve 



is jamming (in Jx mode), the main channel instantaneous SNR 
where J is the instantaneous jamming power subject 
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to the constraint EJ < ^ , while the SNR of Eve's channel is 
zero (recall that whenever Eve jams, she cannot simultaneously 
listen on the same frequency slot). 

From Alice's and Bob's perspective, the new equivalent 
channel coefficients can be written as 
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with the observation that Alice and Bob still have to agree in 
advance on how long Eve should be considered in Ex mode, 
and how long she should be considered in Jx mode (i.e. on 
the value of q). This kind of information will determine the 
encoding strategy and the achievable secrecy rate. 

Denote by X the random variable at the input of the two 
channels, and by Y and Z the corresponding random variables 
received by Bob and Eve, respectively. According to [2j, the 
secrecy capacity of our model (under thejissumption that the 
equivalent channel coefficients Hm and Hw become perfectly 
known to Bob and Eve during transmission, and hence can be 
considered as outputs of the channel) is given by 



C s = max I(V; Y, H M ) - I(V; Z, H Wj 
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where the maximization is over all joint probability distribu- 
tions of V and X such that V — > X — > YZ form a Markov 
chain. The inequality in (0 follows from the independence 
between V and Hw, and holds with equality if V is also 
independent of Hm (i-e. Alice has no a-priori channel state 
information - CSI). Since the optimal choice of V and 
X is presently unknown, we shall henceforth concentrate 
on the achievable secrecy rate (instead of secrecy capacity) 
obtained by setting V = X and picking a complex Gaussian 
distribution for X, with zero mean and variance P. Under 
these constraints, the achievable secrecy rate (over a frame) 
becomes: 
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where P is the instantaneous transmitter power and is subject 
to the constraint EP < g? . 

As we have mentioned earlier, a classical Wyner-type 
secrecy-encoding scheme uses a codebook designed before- 
hand, and taylored to the specific channel conditions (assumed 
known in advance). If a codebook were designed for a specific 
parameter q = q n , it would fail if Eve decided to use any 
different strategy. More precisely, if Eve used qi > q , the 
perfect secrecy of the message would be compromised (we 



call this secrecy outage), while if Eve used qi < qo, the 
secret message would become unintelligible to Bob (we call 
this intelligibility outage). 

As a result, the legitimate parties have to use a transmission 
strategy that can protect both the secrecy and the intelligibility 
of the secret message, under any strategy that Eve might use. 
This problem is best modeled by the conservative scenario 
that makes the assumption that Eve knows Alice's strategy in 
advance. Results for the best-case scenario (or the minimax 
scenario), where Alice and Bob know Eve's strategy in 
advance, are given in lTT2l . Although those results have less 
practical value, they can function as an upper-bound for the 
achievable secrecy rate, and will be used for comparison in 
the numerical results section. 

The simplest encoding scheme that offers secrecy protection 
in our conservative scenario is one of Wyner type, with a 
forwarding rate low enough to protect the message against 
the most powerful attempt to induce intelligibility outage (i.e. 
when Eve is in Jx mode all the time), and with a secrecy 
rate low enough to offer protection against the most powerful 
attempt to induce secrecy outage (i.e. when Eve is in Ex mode 
all the time). The achievable secrecy rate for this kind of 
scheme is 
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(the subscript "wcs" stands for "worst-case scenario'^Xjind 
is achieved under the equivalent channel coefficients hju = 

a 2 

5 " . and hw = hw- The following two propositions 
show that randomizing the instantaneous power is not a geed 
idea for either Alice (P) or Eve (J). 

Proposition 1: When no channel state information is avail- 
able to the transmitter, the optimal transmitter strategy is to 
allocate constant power P = to each symbol. 

Proof: Recall our assumption that both h^j and hw 
are exponentially distributed, with parameters Am and Aw, 
respectively. This means that h^ is also exponentially dis- 
tributed, with parameter Ajv/ (1 + ^4-)- Denote the probability 

distribution of h&j by Jm(x) = Anje~ XMX , and of hw = hw 
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If Ajv/(1 + -^r) > Aw (Eve's equivalent channel is statisti- 
cally "better"), then the achievable secrecy rate is zero. In this 
case the way Alice distributes her power (without knowledge 
of the exact channel coefficients) is irrelevant, and a constant 
power allocation is as good as any. Hence we shall concentrate 
on the case when Am(1 + ^r) < Aw- 

We need to prove that for this case, the function 
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Fig. 2. Exponential distributions and their difference. 

is a concave f] function of P. We can write 

f°° xP 
Rs, wcs (P) = / log(l + —){f M {x) - fw(x))dx. (7) 

JO a N 

Note that Jm{x) — fw{x) is negative for x € [0,cc ) and 
positive for x € [xq, oo), where xq is the (unique) solution of 
Jm{x) = fw(x). Moreover, J °° f M (x)dx = / °° f w (x)dx 
1 , which results in 



lfw(x) - f M (x)]dx = [f M (x)-fw(x)]dx. (8) 

Jx 



A graphical representation of these functions is given in Figure 
|2] where we used the notation f\ = Jm and fi = fw- Take 
an increasing function G(x). We can write 



G(x)[f w (x) - f M (x)]dx < 



< / G(x )[f w (x) - f M (x)]dx 



G{x )[f M (x) - f w (x)}dx < 



< / G{x)[f M {x) - fw{x)]dx. (9) 

J Xq 

Now, taking G(x) = log(l + we see that R S WCS {P) 
is a positive function of P; taking G(x) = ^Jp* 1 = a 'i ^ xP 
we see R S , WCS (P) is increasing; and taking G(x) = d = 

— (^ a i +xP ^j we see Rs.wcs{P) is concave. ■ 
Proposition 2: When in jamming (Jx) mode, Eve's optimal 

strategy is to use the same jamming power J — -f^ across 

all channel realizations involved. 

Proof: The result follows directly from (O, where only 

the first term depends on J, and that term is a convex function 

of J. M 
As a result, the achievable worst-case-scenario secrecy rate 



is now simply 



Eh 



log(l + 



N T- 



hw& 

log(l + —3—) 



1 + 



(10) 



and is rarely strictly positive (if and only if Xw > Aj\/(1 + 
^-)). For a large jamming -power-to-noise ratio £ /cr 2 N , this 
implies that Eve's physical channel needs to be impractically 
worse than Bob's. 

However, the above scheme does not take full advantage of 
the model characteristics. Recall the original assumption that 
Eve can function only as a half-duplex terminal. Therefore, 
whenever Eve is in Jx mode, she cannot eavesdrop - so the 
whole transmission remains perfectly secret to Eve - and 
conversely, if she is in Ex mode, Eve cannot simultaneously 
jam the transmission. 

In the next section we develop an alternative transmission 
scheme, which greatly improves the achievable secrecy rate, 
and is tuned to specifically exploit the active eavesdropper's 
limitations. More specifically, we "quantize" the interval [0, 1] 
to which Eve's strategy q belongs into several smaller inter- 
vals, and we design an encoding/decoding strategy such that 
the worst-case scenario outlined above is only applied on one 
of these sub-intervals. The finer the resolution, the smaller 
the loss of secrecy rate due to the uncertainty about Eve's 
strategy. To make this encoding strategy work, we use the 
following techniques: (i) a posteriori Wyner-type binning, (ii) 
secret key generation, (iii) block-Markov secrecy encoding and 
(iv) encoding for a compound channel. 

III. The Block-Markov Wyner (BMW) Encoding 
Scheme 

There are two main reasons why Wyner's scheme (l | does 
not work in our model. First, Alice does not know the statistics 
of Bob's channel in advance - Eve has control over the signal- 
to-noise ratio of this channel. Therefore, the main channel 
can be modeled as a compound channel. In order to reliably 
transmit a message to Bob, Alice should use a special kind 
of encoding. It was shown in [131 that the same layered 
encoding technique that achieves the points on the boundary 
of the capacity region for broadcast channels can also be used 
for transmission over compound channels. Our scheme uses 
the broadcast layered encoding of |[T3l to ensure that reliable 
transmission is possible between Alice and Bob even in the 
most unfavorable conditions. However, even if such a scheme 
is used, Alice cannot know in advance which messages will 
actually be decodable by Bob. 

The second reason is that Alice does not know the statistics 
of Eve's channel in advance - due to the alternation between 
jamming and eavesdropping, Eve's equivalent channel is actu- 
ally weaker than her physical channel. Therefore, Alice cannot 
directly transmit a secret message at a rate larger than R s , W cs 
in ( [Tol l, because she is not sure whether the secrecy would be 
compromised or not. 
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We solve these two problems by introducing a posterior- 
binning Wyner-type encoding scheme. Instead of transmitting 
a secret message by Wyner's scheme, we choose to transmit 
white noise, and agree on a secret key at the end of transmis- 
sion, once the channel quality becomes available (a posteriori). 
The secret key is then used over the next transmission interval, 
to encrypt a secret message, which is then transmitted at the 
same time with another sequence of white noise from which 
a new secret key is distilled, and so on. Our approach is 
a sequential one, and requires that Bob should be actively 
involved in the secrecy encoding process. Bob's involvement 
consists of estimating and feeding back to Alice the exact 
value of Eve's strategy q. The detailed description is given 
below. However, before we get to that, we need to present 
some considerations on Wyner's original encoding scheme (TJ, 
which will help build some intuition regarding the principle 
of our own scheme. 



A. An alternative to Wyner's secrecy encoding scheme for 
regular passive-eavesdropper channels: a posteriori binning 

We begin this discussion by studying a scenario where, 
before the transmission takes place, Alice and Bob already 
share a secret key (perhaps one that was agreed upon after 
the previous transmission). Then in addition to the secret 
message that can be encoded by Wyner's scheme, another 
secret message can be transmitted over the channel. This 
latter message is encrypted using the secret key. We provide 
two encoding schemes that can both achieve the simultaneous 
transmission of the two secret messages. 

Denote the capacities of the channels from Alice to Bob and 
from Alice to Eve by Cm ar >d Ce, respectively, the achievable 
secrecy rate (under Wyner's original scheme) by Rk, the rate 
of the encrypted message by R s and the codeword length by 
N. 

Scheme 1: Wyner's scheme with an encrypted message. 
Alice bins the codebook (containing 2 NCm codewords) into 
2 NRk "super-bins", such that R k < C M - C E - The first 
secret message picks the index of a super-bin. The super-bin is 
then binned again into 2 N ( CM ~ Rs ~ Rk ^ bins (each containing 
2 NRs bin-words). One of the bins is picked randomly, while 
a specific codeword in that bin is picked according to the 
encrypted message. 

Scheme 2: The alternative encoding scheme. The codebook 
is randomly binned into 2 n ^ Cm ~ Rs ^ bins - let us denote 
these as "pre-bins". Each pre-bin consists of 2"^" bin-words. 
The bins are then randomly grouped into 2 NRk "super-bins", 
such that each super-bin consists of 2 N ( CM ~ Rs ~ Rk * > bins, and 
where R^ is picked to satisfy R/. < Cm — Ce- The first secret 
message picks the index of a super-bin. A bin inside that super- 
bin is randomly picked, and the transmitted codeword is then 
picked by the encrypted message inside this bin. 

The two schemes are equivalent, and they are described in 
Figure |3] However, as we shall see shortly, the applicability of 
Scheme 2 is more relevant to our compound channel scenario. 
We should recall here that Wyner's original encoding scheme 
JTJ involves a random binning of the codebook into bins 
which are, each of them, good codes for Eve's channel. 



Wyner's secrecy encoding scheme 
with an encrypted message 



Alternative encoding scheme for 
binning at the end of the frame 
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Fig. 3. Alternative binning: Wyner's secrecy encoding scheme with an 
additional encrypted message, and the basis of our block-Markov Wyner 
encoding scheme. 



The actual transmission does not contain any information 
about the binning itself. Hence, the same "random" binning 
needs to be done separately at Alice (before the transmission 
takes place) and at Bob (before he can begin decoding). The 
reason why Alice performs the binning of the codebook before 
transmitting is because she needs to send a meaningful secret 
message over the coming frame. Therefore, the transmitted 
codeword needs to belong to the particular bin indexed by the 
secret message. 

This suggests that if the "secret message" transmitted by 
Alice had no meaning (i.e. if Alice picked this message in 
a random fashion), both Alice and Bob could perform the 
binning of the codebook after the transmission ends. The 
"secret message" generated this way could be thought of as a 
secret key for encrypting a meaningful message over the next 
shared frame. 

Suppose that Eve's channel is unknown to Alice and Bob 
until the transmission of the current codeword ends. The first 
transmitted codeword is randomly selected from the whole un- 
binned codebook. After the transmission ends, Alice and Bob 
realize that the secrecy capacity was R s . Both Bob and Alice 
can now proceed to the (same) binning of the codebook. As a 
result, the same single bin will be identified by both legitimate 
parties as containing the transmitted message, and its index 
will be secret to Eve. Clearly, the secret message conveyed 
by the index of this bin has no meaning. Nevertheless, it can 
be used over the next frame, as a secret key. Over the second 
frame, Alice and Bob use Scheme 2 above. The codebook 
is randomly binned before transmission, into 2 n ( Cm ~ r "> 
bins that could each be regarded as a code for carrying the 
encrypted message. One of the bins will be selected randomly, 
and the encrypted message will select the exact codeword to 
be transmitted. This method of transmission ensures that the 
encrypted message does not overlap with the secret key that 
needs to be generated at the end of the frame - the encrypted 
message has nothing to do with how the bins are ultimately 
chosen, as seen in Figure [3] The encrypted message may be 
decodable, but not decryptable by Eve. After the transmission 
of the second frame takes place, Alice and Bob realize that 
the secrecy capacity was Rk- The indices of the bins are 
"randomly" grouped by both Alice and Bob into 2 NRk super- 
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bins , and a new secret key is agreed upon by the legitimate 
parties. The protocol continues in the same manner. 

Three observations are in order. First, the secret key (de- 
cided upon at the end of the frame) and the encrypted message 
(carried by the frame) cannot overlap and maintain the same 
equivocation at Eve - see the one-time pad fl4l . Hence, 
in the above description of the protocol, it is required that 
R s + Rk < Cm- Second, note that R s = Rk (since the key is 
used as a one-time pad to encrypt the secret message of the 
next frame), therefore, if our previous condition holds in the 
form R s < Cm/2, the transmission of the meaningful secret 
message can be done at almost the secrecy capacity, with a 
small initial penalty (due to the fact that the first frame does 
not carry an encrypted message) which becomes negligible 
as the number of transmitted frames increases]! Third, our 
new protocol can be used whenever Alice does not have a 
good description of Eve's channel over a frame until the 
transmission of the corresponding codeword ends, which is 
precisely the case with our current model. 

B. Detailed description of the BMW encoding scheme 

At this point, we restrict our analysis to particular frame 
(we shall denote the span of a codeword by "frame"). How 
Eve should deal with different frames will be discussed in 
Theorem [5] Over this frame, we assume that Eve chooses an 
arbitrary strategy q = Pr{E\ mode}. Once the transmission 
of the codeword is finished, Bob can accurately evaluate the 
parameter q. Bob can then feed this value back to Alice. Note 
that the knowledge of q provides Alice with the statistical 
description of both the main channel - determined by the 
jamming probability (1 — q) — and the eavesdropper's channel 
- determined by the eavesdropping probability q. Before 
learning Eve's strategy, the channel between Alice and Bob 
appears like a compound channel to the legitimate parties. 
The possible states of this channel are given by the possible 
values of Eve's strategy q, which belongs to the interval [0, 1]. 
To transform this uncountable set of possible channel states 
into a finite set, we divide the interval [0, 1] to which q belongs 
into n subintervals such that 



[0,1] = [<?o,<7i) U [<?i,<? 2 ) ... U [q n -i,q n ] 



(11) 



where qo = and q n = 1. 

For conveying a message to Bob, Alice uses an n-level 
broadcast-channel-type codebook, as in lfl3l . Level i is al- 
located power (1 — oti)ai-i . . . (with otj G [0, 1] Vj = 
1, . . . , n— 1 and a„ = 0) and is designed to deal with a jammer 
which is on with probability 1 — g<j_i over each channel use. 
Also note that qo < q\ < . . . < q n . In the remainder of this 

2 Assume that Eve's channel conditions are always the same. As an example, 
consider a codebook with 10000 codewords, which is used for transmitting 
a secret message of length log(50) bits, according to our protocol. Take 
any random frame. For transmitting the encrypted message, the codebook is 
binned into 200 bins, each containing 50 codewords. One of the bins is picked 
randomly, and the encrypted message picks one of the 50 codewords in the 
bin. After the transmission takes place, Alice and Bob both group the original 
200 bins into 50 "super-bins" (each containing 4 original bins), using the same 
"recipe". The secret key is the index of the super-bin to which the transmitted 
codeword belongs. Note that the actual codeword that was transmitted inside 
this super-bin is picked independently of the choice of the super-bin. 



paper, we shall say that level i is "stronger" than level j if 
i < j, i.e. if level i can deal with a jammer which is on more 
often. The notation is fully justified by Lemma [3] below. 
Denote the rates of the different encoding levels as: 



Ri = Ek, 



log (1 + 



(l-ai)£»fe M 
o% + at 1 &>h M + J 



(12) 



for the strongest level, which can deal with the case when Eve 
is always in Jx mode, i.e. q = qo = 0, 



Ri — E/j 

(1 - Q'i)a t -i • • • OLxSPhM 



U-i log (l 



1 — log I 1 

i- N -rai...aitrn M ' 

(1 - ajjaj-i . ..a\^h M 
+ at... aitrliM 

for i = 2, 3 . . . n — 1, and finally 



Rn = Eft, 



, (13) 



-(1 




(14) 



?B-1 



for the weakest level, corresponding to the case when Eve is 
in Jx mode with probability 1 — q n -\. Note that the encoding 
levels are designed such that Bob decodes the stronger levels 
first, and treats the remaining un-decoded messages as white 
noise. The codebook for level i contains 2 NRi codewords 
of length N, generated such that each component of each 
codeword represents an independent realization of a Gaussian 
random variable of mean and variance (1— CKj)o!i_i . . . aiS?, 
where a n = for compatibility. 

Also note that our scheme uses a constant transmit power 
P = £P over the whole frame. Although randomizing the 
transmit power may sometimes improve the achievable secrecy 
rate, this study is beyond the scope of our paper. However, we 
already know that Eve's optimal strategy is to use a constant 
jamming power £ on all jammed channel uses. This is 
because all the rates Ri,...,R n defined above are convex 
functions of ^ (see Proposition [2}. 

The relative strength of the encoding levels is established 
by the following lemma. 

Lemma 3: If Eve uses a parameter q G over a 

frame, then the messages encoded in levels 1,2, ... ,i are in- 
telligible by Bob at the end of the frame. Thus the forwarding 
rate from Alice to Bob is Rm,i = Ri + R2 + • • • + Ri- 

Proof: In order to prove that the encoding levels with 
lower indices are stronger in the sense that they can deal with 
a worse jamming situation, it is enough to show that Ri as 
defined in ( fT3l ) is an increasing function of q. In other words, 
encoding level i, transmitting at a rate Ri, is intelligible by 
Bob whenever Eve is in jamming mode with a probability less 
than (1 — qi-i). But this is a direct consequence of Lemma [7] 
in Appendix lAl if we simply replace x by ^"'^"'"^'gaf]^ 

and V h y *l+*/. ai &h M < see Appendix [A). ■ 
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Consider the first frame, for which the transmitted mes- 
sage carries no useful information, but rather its symbols 
are selected in a random, i.i.d. fashion. Once Alice receives 
the feedback sequence from Bob at the end of the frame, 
describing Eve's strategy (i.e. the value of q - actually, as we 
shall see shortly, only the interval [qt-i, qt) that contains q is 
enough information for Alice, thus the length of the feedback 
sequence need not be larger than log(n)), Alice and Bob can 
separately agree on the same secret message, as described in 
the protocol above. This message will function as a secret 
key for encrypting a meaningful secret message over the next 
frame. In turn, the secret message agreed upon at the end of 
the second frame can function as a secret key for the third 
frame, and so on. 

To formalize the intuitive description above, we begin by 
stating several definitions: 

• The "encrypted message" is a meaningful secret message, 
encrypted with the help of a secret key that was generated 
in the previous frame. 

• The "secret key" is a meaningless random message, 
which is perfectly secret to Eve, is agreed upon by both 
Alice and Bob at the end of the frame, and can be used 
for the encryption of a secret message (of at most the 
same length) over the next frame. 

• The term "secret key rate" refers to the rate at which 
a secret key is generated at the end of a frame - the 
correspondent of Wyner's "secrecy capacity". 

• The term "achievable secrecy rate" refers to the rate of 
transmission of the encrypted message. 

Our encoding scheme works as follows. First, the n code- 
books, indexed by i, with i £ {1,2, ... ,n} are generated as 
described above, and are made available to all parties. On a 
given frame, Alice transmits an encrypted message, at a rate 

R s < 0.5i?i (15) 

(this constraint is a result of planning ahead for Eve's most 
destructive behavior, and we show in Theorem [5] below that it 
does not incur any loss of performance under Eve's optimal 
strategy) - note that the encrypted message is encrypted with 
the help of a secret key generated over a previous frame. To 
transmit the encrypted message, Alice randomly bins code- 
book 1 into 2 N< - Rl ~ RsS > bins. One of the bins (each containing 
2 NRs codewords) will be picked randomly (uniformly), and 
the encrypted message will pick a codeword from this bin for 
transmission. Recall that the reason why Alice cannot directly 
bin the codebook for generating the secret key is because 
Eve's strategy (hence her equivalent channel) is unknown 
until the end of the frame. An additional n — 1 codewords 
are also chosen randomly, one from each of the remaining 
n — 1 codebooks of rates R2, R3, . . . , R n - Alice's transmitted 
sequence is the sum of the n codewords. 

At the end of the frame, Bob feeds back to Alice the exact 
value of Eve's strategy q over that frame. In order to agree on 
a secret key, Alice and Bob first need to know which encoding 
levels are decodable by Bob, and which are decodable by 
Eve. Only the information encoded in those levels that are 
decodable by Bob, but are not perfectly decodable by Eve, 
can contribute to the generation of the secret key. 



Due to the construction of the code (see Lemma [3}, it is 
clear that under any jamming/ eavesdropping strategy, Bob will 
be able to decode the strongest level first, treating the other 
levels as white noise, and then perform successive interference 
cancellation to decode increasingly weaker levels. However, 
the same statement cannot be made for Eve. Eve's channel 
is quite different from Bob's. While the code is designed to 
handle Bob's unknown-length interference channel, Eve sees 
an interference-free channel that is totally interrupted (1 — (?) of 
the time. In the general case, it is thus possible that the order 
of strength of the encoding levels, from Eve's perspective, is 
not the same as that from Bob's perspective. For example, for 
a code with 7 levels Bob might be able to decode only levels 
1,2,3,4, while Eve-A may be able to perfectly decode only 
levels 1,4,6, 7. In this case, we can re-order the levels from 
Eve-A's perspective, as 1,4,6,7,2,3,5. The first four levels 
are decodable by Eve-A perfectly, the next two are decodable 
by Bob, but not by Eve-A, and the last level is decodable by 
neither. Only levels 2 and 3 can be used for generating the 
secret key. 

For the general case, we shall denote the ordered set of 
indices corresponding to the encoding levels specified by their 
rates in dT2T >- (fT~4T > by J?, and the set of indices corresponding 
to the order of strength of the encoding levels from Eve's 
perspective by J* . There exists a bijection (i.e. a re-ordering) 
B : — > J? , defined as follows: (1) the set of indices 
(in arbitrary order) corresponding to levels that are perfectly 
decodable by Eve is denoted J^; (2) the set of indices (in 
arbitrary order) corresponding to levels that are not perfectly 
decodable by Eve, but perfectly decodable by Bob is denoted 
J?k\ (3) the set of indices (in arbitrary order) corresponding to 
levels that are not perfectly decodable by either Eve or Bob 
is denoted ,f n \ (4) the ordered set J' is defined as 

T={J e ,J k ,J n }. (16) 

Furthermore, we define ^„ e = ,-?n} as the set of indices 
corresponding to encoding levels which are not perfectly 
decodable by Eve. The method of encoding is described in 
Figure [4] Theorem [4] below provides the achievable secret key 
rate for the general case. 

Theorem 4: Consider a given quantization {qi\i G J^} of 
the interval [0,1], and a given power allocation between the 
corresponding encoding levels {ai\i G J'}. Suppose that Eve 
picks a strategy q G [<fc-i , qi) over a frame. Then the following 
secret key rate is achievable over that frame (where the key is 
generated at the end of the frame): 

Rk,i = [ R j- R E,j], (17) 

where: 

• Rj are defined as in (fT2l - (fT4l for j = 1,2, ... ,n, 

• -Re j, j € J^ne are selected such that they satisfy the 
following set of conditions: 

R E ,i > 0.5Ri if 1 e Ae, (18) 

(this condition states that the secret key rate assigned to 
the first encoding level should not exceed 0.5i?i, because 
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Level 1 



Level 2 



Level j 




The size of the secret key 
can not be larger than 2"'° s " 



Fig. 4. BMW encoding method - most general case, when 1 £ J^ne- 



otherwise Eve might choose q = 
secrecy rate could not exceed Ri 



qi, and the achievable 
- Rk — see Theorem [3J 



Reu <RiWe J ne (19) 
(this condition ensures the feasibility of encoding), 



^ Re,i < <?E/j w 



log (1 



w 



N 



(20) 



for any subset 5? of J* n e, and 



E 



+ 



(1 - a t )ai- 



logfl 



'JV 



(21) 



with e positive and arbitrarily close to zero (the latter two 
conditions ensure the secrecy of the key). 
The expressions in d20l l and (f2Tb use the convention a n = 0. 
Note that the bijection B defined above also depends on Eve's 
strategy q, and hence on the interval i to which q belongs. 
Therefore, the set of indices J>u depends on i. 

The following observations are in order. 

(1) Sometimes (when Eve's channel is much worse than 
Bob's) the system of inequalities in ( TT~8T > - ( f2TT > may have 
no feasible solution. Under these circumstances, one possible 
approach is to find a solution of the inequalities in (fT~9b - 
(TZTT i (i.e. to ignore the condition in (fT8l)). This would distill a 
secret key at a rate larger than 0.5i?i. Nevertheless, the entire 
secret key may be used by time sharing. For example, for 
^ne = {1}, we can take Re.i = 0.25-Ri for two consecutive 
frames (the first level would generate 2 x 0.75NRi = 1.5NRi 
secret key bits, and transmit only 2 x 0.25iVi?i = 0.57Vi?i 
bits of the secret message), for the third frame we can use the 
entire level 1 (at rate i?i) to transmit an encrypted message (of 
length 1.5NR 1 -0.5NR 1 = NR 1 bits). With this observation, 
in the remainder of this work we shall only focus on the cases 
in which (fT8] l - (1211 1 admit feasible solutions. 



(2) Since the fundamentals of our approach to the proof of 
this theorem reside in Wyner's original results (TJ, we are 
currently constrained to involving all users in J? ne in the 
generation of the secret key. That is, we are subject to the 
constraint in (fJTJ, and its essentiality will be reflected in the 
proof. Although a larger secrecy rate might be achieved by 
involving only a proper subset of J? ne in the generation of the 
secret key, this kind of improvement is beyond the purpose of 
this paper, and will be considered for further research. 

(3) Although similar-flavor results have been obtained in 
02], |[T6] , our results are quite different because they involve 
"users" which are not decodable by Bob. A discussion of the 
issues addressed in 03), ifTSl is provided in Appendix IE1 

Proof: The proof is based on two observations. First, 
we have already shown that if the secret message is not a 
meaningful one, the binning of Wyner's scheme can be done 
at the end of the transmission, when the statistical properties of 
Eve's channel are known to both Bob and (through feedback) 
to Alice. To accomplish this, both Alice and Bob will have 
to memorize a set of "binning recipes", one for each possible 
value of Eve's strategy (actually only the interval , g^) to 
which q belongs, and not the exact value of q, matters in our 
case). This is a bit different from Wyner's original scheme 
01 where only one such recipe needed to be memorized. 
Therefore, in the remainder of the proof, we can and shall 
treat the process of distilling a secret key as if Eve's channel 
were known to all parties in advance, without losing any 
generality. That is, for the sake of using familiar notation and 
terminology, we shall talk about "encoding" a secret key at 
Alice, for "transmission" to Bob, although the secret key is 
only agreed upon at the end of the frame. 

Second, a secret key K = Uje_^ ^-j * s "encoded" into all 
encoding levels j belonging to J^ ne , i.e. over levels belonging 
to both J?k and J? n . Recall that Bob cannot decode the levels 
of JP n . We do this because it is easier to prove that the whole 
key K is secret to Eve. Once this is accomplished, we shall 
follow a simple argument of Q5J (which we replicate in (T33l 
for completeness) to show that the sub-key Uj<=^ fc Kj> which 
can actually be decoded and used by Bob, is also perfectly 
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secret. 



We use a separate secret key encoding for each of Alice's 
encoding levels in ,^ ne . As a consequence, Eve sees a fast 
fading multiple access channel, where the transmitters have 
different power constraints, but the same channel coefficient. 
In this context, we note that the conditions set forth for the 
rates Rj t E in d20b and (fJTJ are exactly the conditions necessary 
for these rates to belong to the boundary of the capacity region 
of Eve's equivalent multiple access channel. The problem of 
a multiple access eavesdropper AWGN channel was discussed 
in fl31 . However, some of the results in |15| do not necessarily 
reflect our views. We provide an explanation of this assertion 
in Appendix [B] Therefore, we continue with describing a 
correct encoding method which yields an achievable secret 
key rate. 



For any level of encoding j G /„ e , we encode a secret 
key K 3 according to Wyner's scheme (TJ, ifTTl . That is, 
if j 1, we randomly bin the randomly generated N- 
dimensional codebook of codewords into 2 n ^ r >~ Re ^' 

bins. The secret message corresponds to the index of the bin, 
while the exact codeword in the bin is randomly picked. The 
rates Rej are selected as in the statement of the theorem. 
If j = 1 G J? ne (recall that codebook 1 was already 
binned once), Bob generates the bins in two steps: first he 
identifies the 2 N ( Rl ~ R "' bins used for transmitting Alice's 
encrypted message, and then he randomly groups these bins 
into 2 N ( Rl ~ Rs ' 1 } larger bins. A secret message is encoded 
into the indices of the resulting larger bins. 



Denote the resulting A-dimensional output sequence of 
level j by Xj, and denote the p-th component of Xj by 
Xj(p). Also denote the union of the A-sequences from all 
levels (including those from which do not carry a secret 
key) by X = [j.^j-Xj, The notation X(p) now denotes 
the n-dimensional set consisting of the p-th components 
of the output sequences from every encoding level, that is 
X(p) = U . e ^-Xj(p). Eve's received sequence is now Z = 
Hvk • 5Zj e< _^Xj + Q, where Hy^ is the A-dimensional vector 
of channel realizations corresponding to the N symbols, Q is 
Eve's A-dimensional additive white Gaussian noise sequence , 
and (•) denotes component-wise multiplication. The p-th scalar 
components of these vectors will be denoted by Z(p), Hw(p) 
and Q(p), respectively. The notation Xj* will be used for the 
union of the output sequences corresponding to levels with 
indices in 5?, i.e. Xy> = {Jj e y Xj, and the notation for the 
p-th components is extended correspondingly. 



Eve's equivocation about the secret key can be written as 



follows 

= H(K\Z,H W ) = H(K,Z,H W )-H(Z,H W ) (a) 
H(K) H(K) 

H(K) +ff(Z,Hyr,X|K) _ 
H(K) 

g(X|Z,H w ,K) + g(Z,H w ) (J 
H(K) 

H(K) + H{Z, H w |X, K) + g(X|K) _ 
H(K) 

g(X|Z,Hvv,K) + g(Z,Hty) (J 
H(K) 

_ - _ J(X;Z,H W Q-J(X;Z,H W |K) 

H(K) ' K ' 

where both (a) and (b) result from the chain rule for entropy, 
while (c) from the fact that K —> X > Z form a Markov 
chain. 

Denote V = I(X; Z, H w ) - /(X; Z, U W \K). We can now 
write 

I(X;Z,n w ) = H(X y J + H(X,s n J - 
-H(Xj? e \Z,H w ) ~ H{X,^JX,^,Z,U W ), (23) 



H(X\K) = H{Xy e ) + H(Xj, ne \K), (24) 

and 

H(X\Z,H W ,K) = 
= H{X,?JZ, H. w , K) + H {Xjf ne \Xj? e , Z, U w , K) < 

< H(Xj, e \Z,H w ) + H(Xjr ne \Xj, e ,Z,H w ,K), (25) 

where we used the fact that {Xj : j G J^} are all independent 
of each other, and that conditioning reduces entropy. Substi- 
tuting (|23l>-(f25T> in the expression of V above, and noting that 

H(X y n J = H(Xjr ne \XjrJ, we obtain 

V < I(Xy ne ;Z, H w \X y J - H(Xy ne |K) + 

+H(X^ ne \Xy e ,Z,H w ,K). (26) 

By the code construction, and recalling that the rates Rej in 
the statement of the theorem are picked such that they belong 
to the boundary of the capacity region of Eve's equivalent 
multiple access channel (they satisfy (BTTi), we can use Fano's 
inequality, the union bound and arguments similar to those 
used in driving equation (78) of JTJ, to upper bound 

H(Xj? ne \Xj? e ,Z,H w ,K) <NS N , (27) 

where <5jy — » as N — > oo. This is quite intuitive, since given 
the secret key, the other information is transmitted by Alice 
using codes which are good for Eve's multiple access channel. 
In fact 

Sn = ^ -j^KPej) + PcjRej, (28) 

where p e j is the probability of error for the layer-j such code, 
and h(-) is the binary entropy function h(x) = —x\og 2 {x) — 
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(1 — x) log 2 (l — x). Since the random, complementary-to-the- 
secret-key information is carried by these codes at a total rate 
almost equal to the capacity of the virtual MAC between Alice 
and Eve, corresponding to the encoding levels in ^ ne , we also 
have 



Zf(Xjr ne |K) = 
(1 - a J )a J _ 1 . . 



NqE hw 



logfl 



a 



N 



Ne. 



To upper bound the first term on the right hand side of 
we write 



I(Xjr ne ; Z, H W |X 

H(z,n w \Xy e ) - H(z,n w \x. 



(a) 

(b) 



H{Z,H w \Xs.)-NH(Z(p),H w (p)\Xs(p)) < 

< NH(Z(p),H w (p)\Xy e (p)) ~ 
-NH(Z(p),H w (p)\X.s(p)) = 

= NI(Xs ne (p); Z(p),K w (p)\Xs e (p)) < 



log (1 + 



'N 



(30) 



Equality in (a) follows from the fact that the channel is 
memoryless, (b) follows from the chain rule for entropy and 
the fact that conditioning does not increase entropy, and (c) 
is obtained by using Jensen's inequality, as in the proof of the 
converse to the AWGN channel coding theorem in Section 9.2. 

of na. 

Putting together (|27), (f29]l and d30j, we obtain 



V < N(e- 
which in turn implies 

A > 1 - N- 



H(K) 



(31) 



(32) 



Since H ffl is a constant, the right-hand side of d32l converges 
to 1 as N — > oo. Thus, we have proved that the key K 
remains secret from Eve as long as the codeword length N 
goes to infinity. However, note that the entire key K cannot 
be understood by Bob. In fact, Bob and Alice can only agree 
on the part K ji k of the key. But the secrecy of the entire key 
guarantees the secrecy of any part of the key fl31 . For the sake 
of completeness, we restate the following proof from lfl5l . 



H(K J rjZ,H w ) 



H(Ky ne \Z, U w ) - H(Kj n \Ky k , Z, U w ) > 
>H(K)-N(e + S N )- 

-H(Ks n \Ks k ,Z,H w ) > 
> H(Ky h ) + H(Ky n ) - N(e + 6 N ) - 

-H(Ks n \Ks k ,Z,n w ) > 
>H(Kj? k )-N(e + S N ), 



where (a) follows from the chain rule, (b) from (1321 and 
the definition of A, (c) from the independence of the keys 
from different encoding levels, and (d) from the fact that 
conditioning does not increase entropy. 
This results in 

H(Ks k \Z,H w ) ^ , Ar e + 6 N 



> 1 - N 



H(Kj k ) 



1 



(34) 



(29) 

as N — > oo (because 



w 



is a constant). Therefore, a per- 



fectly secret key can be distilled from the random information 
transmitted by the encoding levels in ,fk- ■ 

We have seen the best achievable secret key rate if q <E 
[qi-i,qi). The next theorem provides Eve's optimal strategy, 
i.e. which is the most destructive value of q under the present 
conservative scenario, and also Alice's best achievable secrecy 
rate under this eavesdropper strategy. Note that although the 
game between Eve and the legitimate parties Alice and Bob 
is a dynamic one, where Bob and Alice need to re-evaluate 
their strategies over each frame, the following result can be 
thought of as some form of equilibrium. Indeed, under our 
assumptions, it is sub-optimal for either Eve or the Alice/Bob 
pair to deviate from the following strategies. 

Theorem 5: Consider a given quantization {qi\i G ^} of 
the interval [0,1], and a given power allocation between the 
corresponding encoding levels {ci!j|i G 

(1) If Eve's optimal value of q is such that q G [q%—i,Qi), 
then q is arbitrarily close to c^. 

(2) Eve's optimal strategy q under our conservative scenario 
is the same over all frames. 

(3) Denote the achievable secret key rates by {Rk,i '■ i = 
1,2,..., n}, where Rk } i is the best achievable secret key rate 
given by Theorem |4] under q = qi. Then Eve's optimal 
strategy is q iopt = axgmm qi {R k ,i}, if min 9i {i? fcji } < 0.5i?i, 
and qi opt = q%, otherwise. 

(4) Under Eve's optimal strategy, the maximum achievable 
secrecy rate (under the current setup) is 



R s = mm{0.5Ri,Rfc,i opt }. 



(35) 



(33) 



(5) There is no loss of performance incurred by restricting 
the rate of the encrypted message to R s < 0.5R\ in (fT3T >. 

Proof: (1) Using Theorem[4] it is easy to check that, given 
q G [qi-i,qi), the achievable secret key rate is a decreasing 
function of q. Therefore, if q G [qi-i,qi), Eve's optimal 
strategy is to pick q arbitrarily close to qi. 

(2), (3), (4) We have already mentioned that our encoding 
strategy restricts the rate of the encrypted message to R s < 
0.5i?i, by restricting the rate of generation of the secret key 
to Rk < 0.5i?i. If min gi {i?fc i} is achieved by qi opt and is 
less than 0.5i?i, then by switching to a different strategy q^, 
Eve will only increase the rate of generation of the secret key, 
and hence the rate of transmission of the encrypted message. 
On the other hand, if mm qi {Rk.i} > 0.5i?i, then no matter 
what Eve's strategy is, the secrecy rate will be constrained by 
the encoding scheme to 0.5i?i. 

(5) The constraint introduced by the encoding scheme is a 
conservative one. Although the secret key may be generated by 
multiple layers, at the end of a frame, the encrypted message 
is transmitted only by the first encoding level. This is because 
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neither Alice, nor Bob know the channel quality in advance, 
and thus, to ensure reliable decoding of the secret message, 
they have to plan for the worse. For example, Eve might 
choose to constantly play a strategy q £ [0, qi), which implies 
that Bob will only be able to decode level 1 of the code. 
This message, transmitted at a maximum rate of R±, has 
to carry the encrypted message and generate a secret key, 
simultaneously. But since Eve's strategy remains in [0,qi) 
over the next frames, the rate of the encrypted message cannot 
exceed 0.5i?i - there would not be enough secret key bits to 
encrypt it. Therefore, the strategy q £ [0,qi) can function 
as a "default" state for Eve, where she could take refuge if 
the achievable secrecy rate under any other strategy exceeded 
0.5Ri. M 

Theorems [4] and [5] above offer a good description of the 
achievable secrecy rates. However, in Theorem [4] we assumed 
that the set J> e of indices corresponding to the levels that 
are perfectly decodable by Eve, and the sets Jf^ and are 
readily available. Due to the fact that our encoding scheme is 
designed such that Bob should perform successive interference 
cancellation, the set of levels that are not decodable by Bob is 
easy to compute. However, the characterization of the set <f e 
and its complement J^„ e is not straightforward. The following 
proposition shows how these sets can be found. Its proof 
results from Lemma [S] in Appendix [C] 

Proposition 6: The maximal set of indices J^ e correspond- 
ing to the levels that are perfectly decodable by Eve is the 
largest of the sets ~f e for which 



]T Rj < qE hw 



log 1 



Y.j^yi 1 - a j) a j-i ■ ■ ■ aiZ?h\ 



w 



v.y c %, (36) 



where is the complement of % with respect to 

C. On the Complexity of the Algorithm: Selecting {a,} and 
{Qi}- 

Our results so far facilitate the computation of an achievable 
secrecy rate, given a partition of the interval [0, 1] expressed 
in terms of the parameters {qi, q<2, • • • , q n ~i}, and a power 
allocation between the encoding levels, given by the parame- 
ters {ai, ct2, ■ ■ ■ , a n _i}. If Alice and Bob wish to exploit the 
full secrecy capabilities of the model, they should perform a 
maximization of the achievable secrecy rate with respect to 
the parameters {(qi, on) : i = 1, 2, . . . , n — 1}. 

The optimization problem requires a high complexity nu- 
merical algorithm. Recall that for each value of the parameter 
vector {(qi,ati) : i = 1,2, ...,n — 1} we need to find the 
set J? e as in the Proposition [6] which involves combinatorial 
complexity. Given J? e , we need to find the optimal set of 
encoding layers that should be involved in the elaboration of 
the secret key. The following example illustrates the steps of 
the algorithm for the least involved scenario: that of n = 2. 

A simple case: n = 2 

We start by selecting a value for the parameter vector 
(<7i,ai). The transmission rates for the two encoding levels 
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Fig. 5. Eve's equivalent-MAC capacity region. 



become: 



log 1 



(l- ai )^h M 
a 2 N + a 1 0>h M + J 



(37) 



and 



Ri = Ej, 



q 1 log 1 



M 



N 



-(l-gi)log 1 



M 



(38) 



\ U N t l- qi 

To illustrate all possible cases, we shall refer to Figure [5] 
where we represented the (equivalent-) MAC capacity region 
of Eve. Although this region depends on Eve's strategy q £ 
{<7i,l}, we shall use it as a reference frame, in which the 
tuple (Ri, R2) (which is fixed as above) can occupy different 
positions, depending on q. 

Depending on Eve's strategy q £ {<7i,l}, we have the 
following two algorithms: 

If q = q\, only level 1 is intelligible to Bob. 

1) If 

(l-ai)@>hw^ 



log 1 



loe 



log 1 



'N 



> R 



1, 



N 



> R1+R2, 



(39) 



(40) 



(41) 



or, equivalently, if the tuple (R%,R2) is inside the 
capacity region of Figure [5J then = {1,2} (i.e. both 
levels are perfectly decodable by Eve.) In this case, no 
secret key may be generated, and no secret message may 
be transmitted. 



2) Else, if 

qi'Eh 



log 1 



(1 - ax)&>hw 



> Ri, (42) 



which, along with the condition that we are outside the 
capacity region implies 



log 1 



N 



< R%, 



(43) 



that is (Ri,R?) is in the region O2 of Figure [5] then 
= {lj.But since level 2 is not intelligible to Bob, 
no secret key may be generated. 



12 



3) Else, if 



log 1 



an&>h 



IV 



a 2 N + (1 - otfi&hw 



> 



> R 2 , (44) 

which (since not in the capacity region) implies that 

(1 - ai)^ a ^ > 



<7iEft w 



log 1 



< Ri, 



(45) 



then = {2}. For this scenario, only level 1 may 
generate a secret key at a rate equal to min{0.5i?i, R\ — 
qiEhw [log(l + y )|}. 
4) The remaining case is when neither of the two en- 
coding levels is intelligible to Eve. Under this as- 
sumption, both levels 1 and 2 may be involved in 
the generation of the secret key. A secret key may 
be generated at rate min{0.5i?i, R\ — Re,i}, where 
R E ,x is either equal to giE hw log (l + ^ft^4 
if (Ri,R 2 ) is in 04Un 5 of Figure [5] or Res 



qi Eft 

n 3 \jn 



log ( 



1 



} - R 2 if (Ri,R 2 ) is in 



N- 



If q = 1, both levels are intelligible to Bob. 
1) If (Ri,R 2 ) is in Eve's capacity region, i.e. 

(1 - a x )&>h w 



E;, 



E, 



log ^1 + 
log[ 



N 



N 



>i2i 



> R2, 



E;, 



log 1 



N 



> R\ + i?2 , 



(46) 



(47) 



(48) 



then J 2 ^ = {1,2} (i.e. both levels are perfectly decod 
able by Eve), and no secret key may be generated. 
2) Else, if (Ri,R 2 ) € Cl 2 , i.e. 

(1 - a 1 )3 g h w 



E ; , 



log 1 



(7% + ax&h 



w 



and 



E, 



log 1 



'N 



> #1 



< R 2 , 



(49) 



(50) 



then J^ e = {!}. For this scenario, level 2 may generate 



a secret key at rate R 2 — ~E*h w log ^1 
3) Else, if (R U R 2 ) E fii, i.e. 

ai&hw 



^ 



Eft, 

and 



log 1 



a 2 N + (1 - ai )^h w 



E, 



log 1 



(1 - ax)&>h w 



' N 



>R 2 , (51) 



< Ri, (52) 



then J'e = {2}. For this scenario, level 1 may 
generate a secret key at rate min{0.5i?i, Ri — 



E, 



log 1 



(l-ai)^hn 



0]> 



4) When neither of the two encoding levels is intel- 
ligible to Eve, both levels may be involved in the 
generation of the secret key. We can achieve the se- 
cret key rate given by R\ + R 2 — Re,i — Re,2, 
where R E ,i and R E . 2 are chosen such that Re,i + 
Re, 2 = Eft w [log(l + ^)j, 0.5i?! < R E ,i < 

min^.E^ [logfl+ ^p )]}, and R E , 2 < 

min{i? 2 , Eft w log (1 + ai ?" f )1 }, with the observa- 

L V /J 
tions following Theorem |4| 

Since we are currently investigating the conservative sce- 
nario, Eve will pick the strategy (q = qi or q = 1) which 
yields the minimum secrecy rate. We have to find the value of 
(<?i, cti) which yields the largest such minimum. Equivalently, 
the optimal (q±, a±) will provide equal achievable secrecy rates 
for q = qi and for q = l. 

It is important to note that, although the algorithm may 
be extremely complex, it needs to be solved only once for the 
desired value of n. The optimal parameters may then be stored 
at both legitimate parties. 

In an effort to reduce the complexity of the algorithm, we 
propose to pick the parameters {(<&):£ = 1, n — 1} such 
that {q ,qi,q 2 , . . . ,q n -i,q n } are all equally spaced, which 
corresponds to a uniform partition (or "quantization") of the 
interval [0, 1]. With this rule in place, the optimization needs to 
be performed only over the (n — 1) parameters ct\, . . . , a„_i, 
hence the complexity is reduced by half. 

From our numerical results for n = 2 and n — 3 (see Figure 
|8}, the loss of optimality due to the uniform partition of [0, 1] 
is not very significant. We conjecture that, as n increases, this 
loss of performance should become negligible. Our remark is 
based on the fact that as n — > 00 the optimal partition of the 
interval [0, 1] approaches a uniform partition (with a vanishing 
step). 

IV. Numerical Results 

In Figures [6] and [7] we show the improvement of our 
BMW secrecy encoding scheme over the worst-case scenario 
approach of ( TTOb . Note that if Eve's channel coefficient is close 
(statistically) to Bob's - the case of Figure [6]- the worst-case 
approach of ( fTOt - or equivalently the case n = 1 - cannot 
achieve a positive secrecy rate. 

However, even Wyner's pure scheme implemented as in ( fTOb 
can achieve a positive secrecy rate if Aw > Aj\/(1 + - 2 ^-), as 
discussed in Section [II] — see Figure|7] The merit of our novel 
encoding scheme is significant. 

The best-case (or "minimax") scenario solution of lfT2ll is 
given in both Figures [6] and [7] for comparison. The "minimax" 
scenario describes a situation when Alice and Bob can know 
Eve's strategy in advance (or, in game-theoretic terms, Alice 
plays first). Although this scenario may not seem like a rea- 
sonable model, it serves as an upper-bound on the achievable 
secrecy rates. 

Figure [8] depicts the performance of the BMW secrecy 
encoding scheme when the partition of the interval [0,1] into 
intervals of the form [<&_!, <?i) is done uniformly, i.e. the 
parameters q , qi, q 2 , . , . , q n are equally spaced, instead of 
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Achievable secrecy rates vs. transmitter power constraints. o =1 , J=5, X ,,=0.2, X w =0.8 



- sequential scheme, n=2 

- sequential scheme, n=1 

- sequential scheme, n=3 

- minimax solution 




5 10 
transmitter power P 



Fig. 6. Achievable secrecy rates with our BMW secrecy encoding scheme. 
Exponentially distributed channel coefficients with Am — 0.3, X\v = 0.8, 
1. 



J = 5, <j 2 n 



Achievable secrecy rates vs. transmitter power constraint.a =1 , J=5, X =0.2, X =1 .5 
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transmitter power P 



Fig. 7. Achievable secrecy rates with our BMW secrecy encoding scheme. 
Exponentially distributed channel coefficients with Am = 0-2, = 1-5, 

■7=5, Ojy = 1. 



being picked in an optimal way. We note that the degradation 
of the achievable secrecy rates is quite small and decreasing 
as n increases. Figures [9] and [10] show the design parameters 
used for obtaining the results of Figure [8] 

V. Conclusions 

We have seen how an active eavesdropper can seriously 
decrease the achievable secrecy rate in a classical scenario of a 
fast-fading AWGN channel with an eavesdropper. Our scenario 
models the most conservative and most practical approach to 
the active eavesdropper. 

We have seen that, in order to take advantage of the 
non-duplex nature of the eavesdropper's terminal, we need 
a more elaborate, block-Markov Wyner encoding scheme. 
While in the classical eavesdropper scenario the legitimate 
receiver is completely passive, our scheme relies heavily on the 
cooperation of the receiver. That means that at the end of each 
frame, Bob is required to feed back to Alice information about 
Eve's strategy, and then, based on this information, replicate 
Alice's efforts to distill a secret key. 



Achievable secrecy rates vs. transmitter power constraint.a =1 , J=5, >. =0.2, .5 




sequential scheme, n-2 

sequential scheme, n=3 

sequential scheme, n-2 - approximation 

sequential scheme, n=3 - approximation 



5 10 
transmitter power P 



Fig. 8. Achievable secrecy rates with our BMW secrecy encoding scheme, 
with uniform and with optimized partition of the interval [0, 1]. Exponentially 
distributed channel coefficients with Am = 0.2, Aw = 1.5, J = 5, aj^ = 1. 



parameters for n=2 — o^=1 , J=5, >- M =0.2, ^=1 .5 
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transmitter power P 



Fig. 9. The encoding parameters q\ and 01 for the case n = 2: optimal 
and uniform partition of the interval [0,1]. Exponentially distributed channel 
coefficients with Xm = 0.2, A^y = 1.5, J = 5, cr^ = 1. 



ign parameters for n=3 - 
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optimal q 1 for n=3 
optimal q 2 for n=3 
optimal u 1 for n=3 
optimal a 2 for n=3 

-0.33 - uniform partition 
■0.66 - uniform partition 

- - optimal tt, for uniform partition 

- 4i - optimal a 2 for uniform partition 



transmitter power P 



Fig. 10. The encoding parameters q±, q2, cti and «2 for the case n = 3: 
optimal and uniform partition of the interval [0,1]. Exponentially distributed 
channel coefficients with Xm = 0.2, \\y = 1.5, J = 5, a^L = 1. 
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Although the performance of our BMW scheme remains 
below the secreccy rate upper-bound provided by the best-case 
scenario of lfl2l . the improvement it brings over the passive- 
receiver solution is quite significant. 

Appendix A 
A Useful Lemma 

The following lemma is used several times in this paper. 
Lemma 7: The function 



/(g) = ?log(l + s) + (l-?)]og 1 + 



l ~1 . 



(53) 



where x, y > 0, is strictly increasing and strictly convex as a 
function of q. 

Proof: It is straightforward to compute 



df(q) 
dq 



log (1 + x) 



l 



1-9 



1 + 



1-9 (l + T^Xi+^+T^r 



(54) 



and 



xy 

WW 



d 2 f{q) 

dq 2 (l + T ^)( 1 + ^+T^) 



(55) 



(l + T ^)(l + , + T ^) J 

Since 1 + > 1 and 1 + x - ( j^) 2 < 1 + x + j^, 

we can state that d J^f 1 > 0. Therefore, is a strictly 

increasing function of q. But evaluating the first derivative in 
q = we get 



'1 
dq 



(0) 



log 



log 1 



(l + :c)(l + y) 
1 + x + y 
xy 



xy 



(l + y){l + x + y) 
xy 



> 



l + x + yj (l + x + y)(l + y) 
xy xy 



> 



(l + x)(l+y) (1 + a; + „)(! + „) 



(b) 

> 0, (56) 



where inequality (a) follows from log(l + /3) > for any 
j3 > — 1, /3 ^ 0, if we replace /3 = , while inequality 

(b) follows since x > 0. Therefore is always strictly 

positive and strictly increasing, which implies that f(q) is 
strictly increasing and strictly convex. ■ 



Appendix B 

Comments on previously existing results on MAC 

SECRECY 

The most notable recent results on the achievable secrecy 
rates for MACs are provided by 1151 and 0161 . Although the 
papers bring unquestionable contributions relevant to our own 
scenario, such as the concepts of individual and collective 
secrecy, and the improvement of the secrecy sum-rates by 
noise injection (cooperative jamming), we feel that there 



are some misleading issues related to their proposed secrecy 
encoding method. This why we re-formulate the collective- 
secrecy JT5 | encoding method in the current paper. 

The encoding method of |fl5l uses a separate secret message 
encoding for each user, much like our own encoding scheme. 
However, unlike the present paper, the secrecy encoding of 
[15| employs a "superposition encoding scheme" (see Section 
III of both 1TT3I and ifTBI ). In the following paragraphs, we 
provide a brief description of this technique. 

Take one user with power constraint P. The user generates 
two independent codebooks, in the following manner: the first 
codebook contains 2"^" TV-dimensional codewords, and each 
letter of each codeword is independently generated, according 
to the realization of a Gaussian random variable of zero mean 
and variance aP; the second codebook contains TV- 
dimensional codewords, and each letter of each codeword 
is independently generated, according to the realization of a 
Gaussian random variable of zero mean and variance (1— a) P. 
The secret message - transmitted at rate R s - picks a codeword 
from the first codebook, while another codeword is randomly 
picked from the second codebook. The message transmitted 
by this user is the summation of the two codewords. 

At a first glance, it appears that the transmitted message 
belongs to a codebook of 2 Ni - Rs+Ra " > TV-dimensional code- 
words, in which each letter of each codeword is the realization 
of a Gaussian random variable of variance P. Moreover, the 
codebook is already binned, like in Wyner's scheme HI, ifTTl . 

However, if the transmitted message is completely decod- 
able by Bob, the rates R s and Rq should be situated within 
the corresponding MAC rate region. For example, if we had 
a Gaussian eavesdropper channel where the AWGN variances 
were 1 for both channels, while the absolute squared channel 
coefficients are 1 for the main channel and for the eaves- 
dropper's channel, the rates should satisfy R s < log [1 + aP], 
Rq < log [1 + (1 - a)P], and R s + R < log [1 + P}. But the 
first two conditions do not appear in fl31 . 

Even if these conditions were satisfied, we believe that the 
"superposition encoding scheme" of lfT31 is not equivalent to 
Wyner's scheme. The key to Wyner's scheme is that each 
bin makes a "good" codebook for the eavesdropper. That is, 
given the secret key and the eavesdropper's received message, 
the bin chosen by the secret key conveys information to the 
eavesdropper at a rate arbitrarily close to the eavesdropper's 
channel capacity. 

For the same toy model as above, the rate of each bin should 
be arbitrarily close to log [1 + Phk] ■ However, under the "su- 
perposition encoding scheme" of fTBI . this rate cannot exceed 
log [1 + aPh$ To achieve the capacity of the eavesdropper's 
channel, a would need to be arbitrarily close to 1. But then 
the codebook associated with the secret message would be 
generated with arbitrarily small power. If a positive secrecy 
rate R s is still desired, the intelligibility of the secret message 
at the legitimate receiver is compromised. Thus, we do not 
expect that the proposed encoding method of lfl5l will achieve 
the secrecy rates claimed therein. 

3 Note that although the second codebook has a rate equal to log [1 + Ph^] 
in 1151 . this rate is not sustainable by the eavesdropper's channel with power 
constraint aP. 
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At this point, we want to emphasize the fact that, except for 
the encoding method, the results of |fT31l and Ifl6l are correct. 
However, our Theorem [4] is quite different than these results. 
Our secrecy-encoding scheme involves in the generation of 
the secret key the levels that are non-decodable by either 
Eve or Bob. In the context of lfT31l and |[T6l . this would be 
equivalent to having some users transmit at rates not supported 
by the receiver, but still help with the transmission of secrecy. 
Although this approach would not make much sense in |fT31 
and lfT6l . it fits perfectly with the constraints of our compound- 
channel-like scenario. 

Appendix C 
Proof and Motivation of Proposition [6] 

As we stated earlier, from Eve's point of view, the different 
encoding levels are very similar to different users. Therefore, 
Eve's channel can be seen as a multiple access channel (MAC), 
with n users, each with a different power, but all sharing 
the same channel coefficient. However, to the best of our 
knowledge, in the current literature there is no treatment of 
the achievable rate region for a set of users when the other 
users are not decodable. 

To motivate Proposition|6] we look at the two-user Gaussian 
MAC, the capacity region of which is given in Figure [TTJ Let 
the capacity of the first user's channel (when user 2 is absent) 
be C\ = log(l+Pi/(j^r), and the capacity of the second user's 
channel (when user 1 is absent) be C 2 = log(l + P 2 /o-f f ). 
We know that the achievable rate region is given by all pairs 
(Ri, R 2 ) that satisfy OJ] Ri < C u R 2 < C 2 and Ri + R 2 < 
log(l + (Pi+P 2 )/ajj). This implies that when user 2 transmits 
at a rate R 2 = C 2 , user 1 should be decoded by treating 
the second user as white Gaussian noise, and by performing 
successive interference cancellation. The first user's maximum 
decodable transmission rate is then Ri = log(l + P 1 /(cr^ r + 

However, it is not straightforward to see whether, when the 
second user uses a randomly generated Gaussian codebook at 
a rate R 2 > C 2 and cannot be decoded, the first user may 
employ a transmission rate larger than log(l + Pi/(a% + P 2 )) 
(region SI4) . To justify our question, consider the following 
"decoding" method. First, a list of possible codewords is 
computed for user 2, by treating user 1 as interference, and 
selecting only those codewords of the second user's codebook 
that have a non-zero a posteriori probability. This list may 
be shorter than the second user's whole codebook, and the a 



posteriori probability of the codewords therein may be non- 
uniform. Then, using this information about user 2, we attempt 
decoding for user 1. Proposition [6] states that this method is 
no better than the one which treats user 2 as white noise. 

In the remainder of this appendix we formulate and prove 
the following lemma, which considers a general Gaussian 
MAC, and from which the proof of Proposition [6] is straight- 
forward to derive. 

Lemma 8: Consider a Gaussian MAC with users j G J^, 
each with average power constraint Pj, j G ^f, and each 
transmitting at a rate Rj , j £ /. Let the variance of the ad- 
ditive white complex Gaussian noise be a 2 N . We are interested 
in the maximum number of users that are decodable by the 
receiver. The maximal set of indices ^ e G ^ corresponding 
to these users that are perfectly decodable by the receiver is 
the largest of the sets for which 



E 

je^ 



Rj < log (1 



N 



P 



vycy e , (57) 



where Y ne is the complement of %, with respect to 

Proof: Denote the largest of the sets Y e for which d57l ) 
holds by "f*, and its complement in by y* e . Assume that 
y* e is non-empty (if it is empty, the result of the lemma is 
trivial). Note that all users in ^* are decodable. However, if all 
users of ~f* e were decodable, then the property in $5l\ would 
hold for , hence 'f* would no longer be the largest set with 
that property. Therefore, not all users of are decodable. 

For the users in ^* e , consider the the rate-region where: 
(1) none of the users can be decoded by treating the others as 
interference, (2) if any one user were decodable (i.e. provided 
to the receiver by a genie), then all other users would be 
decodable and (3) not all users are decodable. This region 
can be characterized as 

M N = { (Ri)ieY- e \Rj > log (1 + g - ^ 



j^y 



(for |^* e | = 2, is represented in Figure ITTb. 

Next we prove that such a rate region is non-empty for the 
users in f^e- To accomplish this, we show by mathematical 
induction that 




log (1 



P, 



< 



< log (1 + ^-2 , 



'N 



), vycc 



(58) 



which means that if the first condition in the definition of 
holds for all j G 5? , this does not prevent the second condition 
in the definition of fijv from holding as well. 
For = {i} we have 

P. 



log 1 



<log(l + -J-). (59) 
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If {58]l holds for a set S?, that is 



53 log (1+ 



a N + Y^k£-r*^\{j} Pk 



)< 



< log 1 



'N 



(60) 



then adding another user r to we get 



E lo g( 1+ ^-,v P> 



< 



< log (1 



'N 



Pr 



+ log(l + - r 

°« + ^er B « e \{r} -vj 

log' i ~ K = 2S — ) < 



N 



a N + J2k£T* c \{r} P> 



<log(l+ E ^V wPj ), (61) 

where the last inequality holds because it is equivalent to the 
inequality 



a N + J2ke- r- c Pk < a N + u{r} ^ 



CT Ar + Sfeer n » e \{r} 



(62) 



which is equivalent to the inequality 







E p « 




E^ 


< 


















< 


E ^ 






E ^ 


(63) 




fcef„* e \{r} 











which holds because 



Sje^ Pj > P r 



At this point we know that Qn is a feasible (non-empty) 
rate region for the users in f* e and (by construction) no user 
of Ojv can be decodable. Note that the first condition in the 
definition of fljv, i.e. that none of the users can be decoded 
by treating the others as interference, follows naturally for 
all users in Y* e (see the definition of 'f* above), while the 
third condition, i.e. that not all users are decodable, is also 
characteristic of Y* e , as we have already shown. Thus, the 
only restrictive condition on Hn is an upper bound on the 
rates (the second condition). In other words, any rate tuple 
which is feasible for the users in Y* e can be obtained from a 
rate tuple in fi^r by increasing some of the rates. 

But since none of the users is decodable for a rate tuple in 
Ojv, it is not possible that any non-empty set of users suddently 
becomes decodable as some of the transmission rates increase. 
Equivalently, for Figure QT| since none of the two users is 
decodable when they transmit at a rate pair in fijv, it is not 
possible that one of them becomes decodable by increasing its 
rate (such that the rate pair moves to either or H4 or O5). 

To see this, using the notation already established in the 
previous sections (Xj* is the set of transmitted sequences of 



all users in 5?, Z is the received sequence, Q is the noise 
sequence), for any set 5^ C ~f* e we can write 

if(X,y|Z,X^) - 

= if(X^|Xr e *) + ff(Z|X^,Xr e *) - if(Z|X r<r ) = 
= H(Xs>) + ff(Z|X^,X r/ ) - F(Z|X r/ ) = 

^Rj+H( J2 X,- + Q)-.ff(Z|X r< «). (64) 

where the last two equalities follow from the independence 
of the users. Note that H(J2i£-y* \y Xj + Q) increases with 
any rate R4, i £ Y*^ \ 5f . But since all rate tuples under con- 
sideration are outside the capacity region of the users in 'f* e , 
the received sequence Z displays an asymptotic equipartition 
property, as noticed in |19|. Intuitively, this happens because, 
as the rate tuple moves outside the capacity region, the volume 
of the typical set of received sequences becomes as large as 
the volume of the whole channel output space. The immediate 
implication is that outside the capacity region iJ(Z|X-^-») is 
a constant function of the rates of the users in V* e . 

This concludes our proof that the entropy of the users in 
any subset of ~f* e increases as any of the rates increase. But 
since any rate tuple for the users in ~f* e , situated outside of 
the rate region i7jy, can be obtained from a tuple inside fijv, 
by increasing at least one of the rates, and since none of the 
users in at is decodable, this implies that none of the users 
in is decodable. ■ 

A notable consequence of Lemma [8] above is that, in a 
MAC scenario employing Gaussian coding, whenever a user 
transmits at a rate which exceeds its channel capacity, the best 
strategy for the other users is to treat it as noise. 
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